LiteSpeed Technologies OpenLiteSpeed 1.5.0 Release Candidate 4
Approved changes feed: RSS · Atom
cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc4:*:*:*:*:*:*
part: a version: 1.5.0 update: rc4
| Vendor | Litespeedtech (17a5e0b8-e24b-5a2d-86af-9f892cc83a4e) |
|---|---|
| Product | Openlitespeed (b67b3b4a-9063-5995-a1ac-e5cf535a8a31) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/litespeedtech/openlitespeed |
purl2cpe | 2026-06-01 10:12:32.770164 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2018-19792 |
vulnerable | 2026-06-08 05:11:16.111849 |
Details available
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a symlink through which the openlitespeed program can be invoked with a long command name (involving ../ characters), which is mishandled in the LshttpdMain::getServerRootFromExecutablePath function.
Published: 2018-12-03T06:00:00.000Z
Updated: 2024-08-05T11:44:20.563Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-19791 |
vulnerable | 2026-06-08 05:11:16.110824 |
Details available
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substring.
Published: 2018-12-03T06:00:00.000Z
Updated: 2024-08-05T11:44:20.490Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.